Usability: Permissions are confusing [#213074]

What do the different permissions mean? I can't find an explanation of this in the document here http://www.logrus.com/nodequeue/readme.txt

What does 'manipulate queues' allow?
How is this different from adding a role to a single queue on the queue edit page?
What does 'Check each role that can add nodes to the queue.' mean -- the readme implies this allows removal of a node from the queue too.

Comment	File	Size	Author
#9	213074-permissions_are_confusing-D6.patch	2.99 KB	amateescu
#9
#9	213074-permissions_are_confusing.patch	4.16 KB	amateescu
#9

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

catch

he/him

English

CreditAttribution: catch commented 20 February 2008 at 18:04

Title:	please explain permissions for this module	» Permissions are confusing
Version:	5.x-1.2	» 5.x-2.x-dev
Category:	support	» bug
Priority:	Normal	» Critical

I just spent about 20 minutes trying to work out permissions weirdness, so bumping version and status - be nice to get this fixed up before a final release.

So - if you set the add/remove link in a nodequeue to a role via the checkbox, it only shows up if the user has "manipulate queues" permission. Although I haven't yet checked all variations. This is what I thought would happen:

1. any role where the checkbox is checked gets the links if set
2. any role with "manipulate all queues" permission gets the tabs, and the links if checked for their role
3. "manipulate queues" ??? probably access to tabs but to be honest I completely ignored it when initially setting up the module, and didn't think to look back there before I thought the checkboxes would work.

This is what I think actually happens so far, although it's probably still slightly wrong

1. Any role with manipulate queues gets the links and tab if they have the checkbox checked
2. The checkbox has no effect at all if a role doesn't have 'manipulate queues' permission (this is what confused me)
2. manipulate all queues gets all tabs, and links whatever happens

Ideally:

1. checkbox-per-role gives you access to the links
2. checkbox per role gives you access to the tabs - probably this would be set in the same place as the links permissions - on the nodequeue edit page
3. manipulate all queues/administer queues gives you everything all the time
4. 'manipulate queues' disappears because the above behaviour makes it redundant.

Comment #2

merlinofchaos CreditAttribution: merlinofchaos commented 20 February 2008 at 18:07

'manipulate queues' exists as a performance saver.

If a role doesn't have manipulate queues, then the query for the tab doesn't need to be run.

Comment #3

joachim CreditAttribution: joachim commented 6 March 2008 at 07:10

Ah... that makes sense :)
I don't see a way to make the names clearer, unfortunately.

What I'd suggest though is:

On the edit page for a queue:
- list only the roles that have 'manipulate queues'. This would give the admin user some feedback that 'manipulate queues' permission actually does something
- add some help text saying 'Only roles with 'manipulate queues' can be chosen here'.

Could you add a docs page to the handbooks on drupal.org for this module please, rather than a link to a readme elsewhere?

PS. And what about 'Check each role that can add nodes to the queue.'?

Comment #4

ezra-g CreditAttribution: ezra-g commented 13 September 2008 at 19:01

I am marking #264415: Role selection for nodequeue manipulation ignores "manipulate all queues" permission as a duplicate of this, since it describes a solution to this problem;

Quoting dww:

When you add or edit a nodequeue, you can select what roles are allowed to manipulate that queue. Unfortunately, this UI doesn't consider roles with "manipulate all queues" permissions. A few options:

A) Clarify this in the help text with something like "Note, roles with manipulate all queues permission will always be able to manipulate this queue, so they are not listed".

B) Put such roles into the UI with selected checkboxes which are disabled, with a note much like the one above, only "... so you can not prevent those roles from manipulating this queue unless you remove that permission first." (or something). This is slightly more self-evident UI, but will be more work.

I'm happy to work on a patch. In IRC, we decided (A) was probably good enough, but then Earl got excited about (B). So, I'm just awaiting marching-orders from Earl before I work on a patch. ;)

Earl/Merlinofchaos supported B. Please see #2 in the above mentioned issue for my thoughts on making this interface change account for Smartqueue modular access control